PatchSiren cyber security CVE debrief

CVE-2026-44473 ellanetworks CVE debrief

A vulnerability in Ella Core, a 5G core network implementation for private networks, allows a malicious radio with a valid NG Setup to forge PDUSessionResourceSetupResponse messages carrying arbitrary AMF-UE-NGAP-IDs. The affected versions fail to verify that such messages arrive on the SCTP association bound to the UE's logical NG-connection, resulting in unauthorized GTP tunnel creation toward the attacker's radio. This weakness enables traffic interception or redirection for targeted UEs. The issue is resolved in version 1.10.0.

Vendor: ellanetworks
Product: core
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-27
Original CVE updated: 2026-05-27
Advisory published: 2026-05-27
Advisory updated: 2026-05-27

Who should care

Organizations operating private 5G networks using Ella Core, telecommunications security teams, mobile network operators deploying private network slices, and security researchers analyzing 5G core implementations

Technical summary

Ella Core versions prior to 1.10.0 contain a missing authorization vulnerability in NGAP message handling. The PDUSessionResourceSetupResponse handler does not verify that messages arrive on the SCTP association corresponding to the UE's logical NG-connection identified by the AMF-UE-NGAP-ID. An attacker with a valid NG Setup can inject forged responses, causing the core to establish GTP tunnels to the attacker's radio. This violates the expected binding between UE identity and transport association, enabling traffic interception or denial of service. The fix in 1.10.0 adds proper SCTP association validation.

Defensive priority

HIGH

Recommended defensive actions

Upgrade Ella Core to version 1.10.0 or later to obtain the fix for SCTP association validation
Review network segmentation to restrict radio access to authorized SCTP associations
Monitor GTP tunnel establishment logs for anomalous patterns indicating potential exploitation
Validate that NGAP message handling enforces binding between UE contexts and their originating SCTP associations

Evidence notes

The CVE description and GitHub Security Advisory (GHSA-qfxw-v8qx-vj3v) confirm the vulnerability mechanism: missing SCTP association validation during PDUSessionResourceSetupResponse processing. CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H yields a base score of 7.1 (HIGH). CWE-358 (Improperly Implemented Security Check for Standard) and CWE-863 (Incorrect Authorization) are identified as root causes.

Official resources

2026-05-27